Choosing a scan type
Blackbox, Graybox and Whitebox scans give agents different starting points. Pick the one that matches the question you need answered.
| Type | Agents start with | Needs | Best for |
|---|---|---|---|
| Blackbox | Only the address. They test it the way an outsider would. | Nothing extra. | What an attacker without an account can reach. |
| Graybox | Your test accounts. They sign in and test as your users. | At least one test account on the asset. | Roles, tenant isolation, business logic and APIs behind sign-in. Most findings live here. |
| Whitebox | Read-only access to the source code. | A GitHub token on a repository asset. | Code paths that are hard to reach from outside, and confirming root causes. |
Which one should I run?
- Start with Graybox for any product people sign in to. Most serious issues, such as one customer reading another customer's data, are only visible after sign-in.
- Add Blackbox for public surfaces: marketing sites, sign-up and password reset flows, and anything reachable without an account.
- Use Whitebox when you can share the repository and want agents to trace a weakness to the exact code.